PT-2009-5548 · Canonical+2 · Ubuntu+3

Russell Senior · Publicado 2009-09-17 · Atualizado 2024-02-13 · CVE-2009-3232

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions pam-auth-update for PAM versions in Ubuntu 8.10 and 9.4, and Debian GNU/Linux (affected versions not specified)

Description The issue is related to the handling of an "empty selection" for system authentication modules in certain rare configurations. This causes any authentication attempt to be successful, allowing remote attackers to bypass authentication.

Recommendations For Ubuntu 8.10 and 9.4, and Debian GNU/Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2009-3232

Produtos afetados

Debian

Pam

Ubuntu

Pam-Auth-Update

Referências · 10

• http://securityfocus.com/bid/36306 · Correção
• https://security-tracker.debian.org/tracker/CVE-2009-3232 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2009/09/08/7 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3232 · Aviso do Fabricante
• http://secunia.com/advisories/36620 · Aviso do Fabricante
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3232 · Nota de Segurança
• https://usn.ubuntu.com/828-1 · Aviso do Fabricante
• https://launchpad.net/bugs/410171 · Correção
• https://osv.dev/vulnerability/CVE-2009-3232 · Aviso do Fabricante